# Dryx Release Signing Public Key
#
# This key signs every Dryx release. The corresponding private key is held
# on a hardware security module and cannot be exported from it.
#
# This public key is also compiled into the Dryx binary as DRYX_RELEASE_PUBKEY.
# The two MUST match. A mismatch indicates compromise of either the build
# pipeline or this published release channel.
#
# Generated:  2026-05-18
# Algorithm:  Ed25519
# Format:     SubjectPublicKeyInfo (SPKI), PEM-encoded
# Rotation:   every 24 months OR on suspicion of compromise
#
# SHA-256 fingerprint of the SPKI DER (pin this):
#   5dec6b89 654cc07d e1b07f38 cec9f18e 6cad0d38 3afb1a8a aec053a2 0f10d1fd
#
# Verify the fingerprint:
#   curl -sO https://releases.dryx.ai/pubkey.txt
#   openssl pkey -pubin -in pubkey.txt -outform DER 2>/dev/null | shasum -a 256
#   # expected: 5dec6b89654cc07de1b07f38cec9f18e6cad0d383afb1a8aaec053a20f10d1fd
#
# Security architecture and disclosure protocol: https://dryx.ai/security

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAuDwiZnF4arg1UcqGJAw1tC1+fSIPO2z1yI3Z1f22FeI=
-----END PUBLIC KEY-----